Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
tutorial:adm:modules_pwdreset [2018/02/15 14:32] stloukalp [Table] |
tutorial:adm:modules_pwdreset [2019/02/25 13:17] apeterova Password generate |
||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== Modules - pwd-reset: How to reset forgotten password? ====== | ||
+ | The module provides functionality of password reset or, in other words, recovery of forgotten password. | ||
+ | |||
+ | ===== How does it work? ===== | ||
+ | {{ : | ||
+ | |||
+ | |||
+ | ===== Process of restoring your forgotten password ===== | ||
+ | Users can restore their forgotten password via password rest module. User can start the process on CzechIdM´s login page by clicking on " | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | For now, identity email or login are supported and admin can use configuration property to select which of these (or both) can be used. User then confirms password reset request by clicking on submit button. CzechIdM then generates validation token and stores it in password reset request along with time of creation. Validation token is then being sent to user via notification. Administrator can edit the notification using standard CzechIdM notification functionality. Notification is sent to topic " | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | After clicking on link, which contains verification token in GET parameters, user is asked to fill in new password. If password change succeeds (password validation is OK and user can change their own password), then user can log in to CzechIdM with new password. | ||
+ | |||
+ | {{ : | ||
+ | ===== Password generate ===== | ||
+ | Password reset module has process for generating new password by default password policy for IdM. Form for password generate is part of password change component. For generate password to end system is necessary enabled event type '' | ||
+ | |||
+ | |||
+ | Password generate is available by permission '' | ||
+ | |||
+ | <note important> | ||
+ | By default, the " | ||
+ | </ | ||
+ | |||
+ | ===== Reset password in user´s system accounts ===== | ||
+ | Password reset module changes users passwords only in CzechIdM account. To reset passwords in end system accounts you need to have acc module enabled and do a little bit of configuration. Actually the only thing you need to configure is to set IdentityPasswordProvisioningProcessor and PasswordValidateProcessor to respond to PASSWORD_RESET event type. You can do it by setting | ||
+ | |||
+ | < | ||
+ | idm.sec.acc.processor.identity-password-provisioning-processor.eventTypes=PASSWORD, | ||
+ | idm.sec.acc.processor.identity-password-validate-processor.eventTypes=PASSWORD, | ||
+ | </ | ||
+ | |||
+ | After password reset, notification is sent to user with system names and accounts, where password has been changed. This processor have to be enabled with setting | ||
+ | |||
+ | < | ||
+ | idm.sec.core.processor.identity-password-change-notification.eventTypes=PASSWORD, | ||
+ | </ | ||
+ | |||
+ | Now IdM will also reset password on all user accounts which support it. | ||
+ | |||
+ | ===== Installation ===== | ||
+ | Download the module distribution package. The package contains a backend folder. Your IdM Tomcat installation we call IDM in the following example. | ||
+ | - Copy content of the backend folder into your tomcat IdM installation - [IDM]/ | ||
+ | - Set correct access rights to the files if needed ('' | ||
+ | - Restart the IdM application server ('' | ||
+ | - Log in to CzechIdM as an privileged user and go to Settings -> Modules and enable the pwd-reset module. | ||
+ | - Go to the configuration and configure required properties (see below). | ||
+ | - Add the event types '' | ||
+ | |||
+ | ===== Configuration ===== | ||
+ | The module provides following configuration properties: | ||
+ | ^ Property | ||
+ | | idm.pub.pwdreset.allowed.attrs | ||
+ | | idm.sec.pwdreset.token.ttl | ||
+ | | idm.pub.pwdreset.identity.passwordReset.public.idm.enabled | ||
+ | | idm.sec.pwdreset.debug | ||
+ | |||
+ | ===== Video Guide ===== | ||
+ | [[https:// |